slimtoolkit/slim · error

ptmon: unexpected target app state %q

Error message

ptmon: unexpected target app state %q

What it means

After checking for AppFailed, Start() verifies the app state is exactly ptrace.AppStarted. Any other state is considered an internal invariant violation ("cannot really happen") and returns this error. It guards against unexpected state machine transitions from the ptrace app watcher.

Source

Thrown at pkg/app/sensor/monitor/ptrace/monitor.go:125

	if err != nil {
		return errors.SE("sensor.ptrace.Run/ptrace.Run", "call.error", err)
	}
	m.app = app

	appState := <-app.StateCh
	logger.
		WithField("state", appState).
		Debugf("pta state watcher - new target app state")

	if appState == ptrace.AppFailed {
		// Don't need to wait for the 'done' state.
		logger.Error("pta state watcher - target app failed")
		return fmt.Errorf("ptmon: target app startup failed: %q", appState)
	}
	if appState != ptrace.AppStarted {
		// Cannot really happen.
		logger.Error("pta state watcher - unexpected target app state")
		return fmt.Errorf("ptmon: unexpected target app state %q", appState)
	}

	// The sync part of the start was successful.

	// Tracking the completetion of the monitor.
	go func() {
		logger := m.logger.WithField("op", "sensor.pt.monitor.completetion.monitor")
		logger.Info("call")
		defer logger.Info("exit")

		appState := <-app.StateCh
		if appState == ptrace.AppDone {
			m.status.report = <-app.ReportCh
		} else {
			m.status.err = fmt.Errorf("ptmon: target app failed with state %q", appState)
		}

		// Monitor is done.

View on GitHub (pinned to 81940d17fa)

Solutions

1. Note the reported state value and confirm it against the ptrace package's state constants (AppStarted, AppFailed, AppDone).
2. Re-run; if reproducible, check that all slim toolkit components are built from the same version.
3. Report as a bug with the state value if it persists on a clean run.

if err := ptMon.Start(ctx); err != nil {
    if strings.Contains(err.Error(), "unexpected target app state") {
        log.Errorf("ptrace state machine invariant violated (report a bug): %v", err)
    }
    return err
}

When it happens

Trigger: Receiving a state on app.StateCh that is neither AppFailed nor AppStarted during Start() — e.g. AppDone arriving synchronously, or a state value from an incompatible app implementation/version.

Common situations: Rare; typically seen after code changes to the ptrace state machine, mixed library versions, or a race where the app finishes/fails before the watcher processes the first state.

Related errors

• insufficient permissions
• one or more monitors failed: fanotify.error=%q, ptrace.error
• ptmon: target app startup failed: %q
• ptmon: target app failed with state %q
• unexpected app exit

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/1eddef848c61fe71. Report an issue: GitHub.